Blog | ReversingLabs | Research (3)

Featured

April 23, 2024

NVD delays highlight vulnerability management woes: Put malware first

Here's what changes to the National Vulnerability Database mean for vulnerability management — and why you should instead focus on malware and tampering.

April 18, 2024

OWASP looks to future-proof SBOMs with CycloneDX 1.6

The foundation is upgrading the standard for the quantum era, adding ML-readable attestation and more. Here's how it boosts software supply chain security.

March 23, 2020

Exposing Ryuk Variants Using YARA

Getting Ahead of Ryuk attacks using YARA Rules - Continued

March 6, 2020

Sneaky Tools Infiltrating Your Mac Fortress

Potentially Unwanted Apps Masquerade as Well Behaved Applications

February 14, 2020

Reminiscence of the Flashback

The Flashback malware family is among the first widespread malware on MacOS. IAt first it went undetected for a couple of months, but then got a lot of attention in the spring of 2012 because it infected over 500,000 computers.

February 7, 2020

Is Your macOS Safe from Attack - What 2019 has Shown Us

ReversingLabs constantly tracks emerging macOS threats as well as the old, persistent ones. Mac malware developers are actively becoming more clever, attempting to make it harder to detect the malicious nature of their software.

January 31, 2020

RATs in the Library

Public hosting sites present a challenge for defenders when exploited by adversaries to conceal payloads using various encoding techniques

December 23, 2019

When Malware RATs on their Owners

The ReversingLabs Titanium Platform supports configuration extraction from over 40 different RATs/Backdoors, Keyloggers, Downloaders, Ransomware and POS malware.

December 17, 2019

The Hunt for NTCrypt: Exposing a Malicious Packer

ReversingLabs TitaniumCore is a static analysis engine with inspection capabilities that must overcome these obfuscation attempts. To improve visibility in our products, we continuously improve unpacking by supporting new packer formats.

December 13, 2019

Going Behind the Scenes of Cybercrime Group FIN6’s Attack On Retail and Hospitality

A step that an adversary takes during the post exploitation phase of an attack is to establish a command line interface with a computer inside the victim’s network. One recent incident demonstrates the entire intrusion set operated by FIN6, a financially motivated threat actor group.

October 30, 2019

Breaking the Microsoft Authenticode security model

Authenticode is a Microsoft code signing technology software publishers use to guarantee the origin and integrity of their applications. The vast majority of modern software applications are actively using it and depend on its integrity validation system.

October 30, 2019

Breaking the Linux Authenticode security model

Portable executable is probably the most prolific application format used for code distribution. It can be found on a wide variety of hardware and software platforms. That’s why it is no wonder that many systems, other than its native Windows, end up supporting it in one way or another.

October 30, 2019

Breaking the UEFI firmware Authenticode security model

Unified Extensible Firmware Interface (UEFI) is a specification that defines the interfaces between the operating system and the platform firmware. Originally developed by Intel, and now supported by an alliance of software and hardware vendors, UEFI quickly became a standard that displaced the legacy basic input/output system (BIOS).

October 30, 2019

Breaking the Windows Authenticode security model

Authenticode is a Microsoft code signing technology designed to guarantee the origin and integrity of an application. The core principle of its integrity verification system is code immutability

‹ previous next ›

Software Supply Chain Security

Automate SOC Support

Optimize Threat Hunting

Product & Technology

Partners

Alliances

Resources

Company

Events

Press

RL Blog

Featured

NVD delays highlight vulnerability management woes: Put malware first

OWASP looks to future-proof SBOMs with CycloneDX 1.6

Latest

Exposing Ryuk Variants Using YARA

Sneaky Tools Infiltrating Your Mac Fortress

Reminiscence of the Flashback

Is Your macOS Safe from Attack - What 2019 has Shown Us

RATs in the Library

When Malware RATs on their Owners

The Hunt for NTCrypt: Exposing a Malicious Packer

Going Behind the Scenes of Cybercrime Group FIN6’s Attack On Retail and Hospitality

Breaking the Microsoft Authenticode security model

Breaking the Linux Authenticode security model

Breaking the UEFI firmware Authenticode security model

Breaking the Windows Authenticode security model

Topics

Special Reports

Latest Blog Posts

RL Blog

Featured

Latest

Topics

Follow us

Subscribe

Special Reports

Latest Blog Posts